open-telemetry / open-telemetry/opentelemetry-python-contrib
Implement sensitive data sanitization for psycopg2 instrumentation
Nobody has claimed this yet.
- Dominant language
- Python
- Stars
- 1.1k
- Forks
- 1.1k
- Avg merge
- 4d 15h
- Merged PRs (30d)
- 16
Description
Although psycopg2 uses dbapi, it does not instrument capture_parameters=True. It's therefore missing the ability for a user to enable/disable raw db.statement's.
For example, I would expect to apply the parameter similar to enable_commenter and see the raw db.statement:
Psycopg2Instrumentor().instrument(capture_parameters=True)
In my testing, I am seeing db.statements sanitized by default.
I think this is the relevant code:
https://github.com/open-telemetry/opentelemetry-python-contrib/blob/e4d8f10ecd7bcd29c119af0e3ea7c30d4a383f4b/instrumentation/opentelemetry-instrumentation-psycopg2/src/opentelemetry/instrumentation/psycopg2/__init__.py#L143-L154
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start in instrumentation/opentelemetry-instrumentation-psycopg2/src/opentelemetry/instrumentation/psycopg2/init.py around lines 143-154. Compare the existing enable_commenter handling with dbapi instrumentation and determine how capture_parameters should control raw db.statement values. Done means psycopg2 instrumentation supports capture_parameters=True while retaining sanitized statements by default.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- postgresql, python
- Domain
- databases, security
- Issue type
- Feature
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100